VMware ESX contains a buffer overflow that occurs when the VMXNET3 virtual network adapter writes outside its allocated memory space. The flaw is classified as an out‑of‑bounds write (CWE‑787). When exploited, a malicious actor who has local administrative privileges on a virtual machine can trigger this overflow and gain the ability to execute arbitrary code on the host hypervisor, effectively escalating privileges from the virtual machine to the host environment.

Affected vendors and products include VMware Cloud Foundation, VMware ESX, VMware Telco Cloud Platform and VMware vSphere Foundation. All versions that ship with the vulnerable VMXNET3 adapter are susceptible; specific version numbers are not supplied in the advisory.

The CVSS score of 9.3 indicates a high severity and a broad impact on confidentiality, integrity and availability. The EPSS score of 0.00281 (approximately 0.28%) indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires local administrative access within the virtual machine; this is inferred from the description and typical VM privileges. If the conditions are met, code execution on the host hypervisor is achievable, allowing full control of the host.